PlayPausa
lookcarefully

×

Privacy Policy

As the data controller, we declare that the personal data collected for the purposes of the contract/assignment or for the additional purposes for which the data subject has given specific consent will be processed, pursuant to and for the purposes of Article 5 of EU Regulation 679/2016, in a lawful, fair, and transparent manner towards the data subject and collected for the sole aforementioned purposes, according to the principles of accuracy, adequacy, confidentiality, and protection established by the Regulation. Further information regarding the rights of the data subject and the methods of maintaining personal data is contained in the information notices referred to in Articles 13 and 14 of EU Regulation 679/2016, provided to each data subject and in the processing registers, distinguishing the type of data, risk analysis, and preventive measures undertaken. The data controller assumes all responsibility for compliance with the aforementioned principles, the contents, and the requirements of the European Regulation for the protection of personal data and for the correct and regular maintenance and management of such data.

The European Regulation No. 679/2016 GDPR, applicable in all Member States, recognizes the protection of personal data processed by third parties as an expression of respect for human dignity and the fundamental rights and freedoms of individuals. The data subject has a series of rights that can be exercised towards the Data Controller or the Processor who holds their personal data, regulated by Articles 15 and following of the European Regulation, detailed below and made available to the data subject upon request. Therefore, in accordance with the provisions of the current European and internal regulations, we provide you with the following detailed information about your rights:

1. Right of access by the data subject (Article 15 GDPR)

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, if so, access to the personal data and the following information:

• a) the purposes of the processing;
• b) the categories of personal data concerned;
• c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations;
• d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• e) the existence of the right of the data subject to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing;
• f) the right to lodge a complaint with a supervisory authority;
• g) if the data is not collected from the data subject, all available information about their origin;
• h) the existence of automated decision-making, including profiling under Article 22, paragraphs 1 and 4, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

If personal data is transferred to a third country or international organization, the data subject has the right to be informed of the existence of adequate safeguards under Article 46 regarding the transfer. The data subject also has the right to obtain a copy of the personal data undergoing processing, provided that the request does not adversely affect the rights and freedoms of others.

2. Right to rectification of personal data (Article 16 GDPR)

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. The right to erasure ('right to be forgotten') (Article 17 GDPR)

The data subject has the right to obtain from the data controller the erasure of personal data concerning him or her without undue delay, and the data controller shall have the obligation to erase personal data without undue delay if one of the following grounds applies:

• a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• b) the data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing;
• c) the data subject objects to the processing pursuant to Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR;
• d) the personal data have been unlawfully processed;
• e) the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
• f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

The data controller, if they have made personal data public and are obliged under paragraph 1 to erase it, taking into account the available technology and implementation costs, shall take reasonable measures, including technical measures, to inform the controllers processing the personal data of the data subject's request to erase any links, copies, or reproductions of their personal data. Paragraphs 1 and 2 do not apply to the extent that the processing is necessary:

• a) for the exercise of the right to freedom of expression and information;
• b) for compliance with a legal obligation that requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) GDPR;
• d) for archival purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• e) for the establishment, exercise, or defense of legal claims.

4. Right to restriction of processing (Article 18 GDPR)

The data subject has the right to obtain from the controller the restriction of processing in the following cases:

• a) the data subject disputes the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
• b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use;
• c) even though the controller no longer needs the personal data for processing purposes, the personal data are necessary for the data subject for the establishment, exercise, or defense of legal claims;
• d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

If processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. The data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.

5. Obligation to notify in case of rectification or erasure of personal data or restriction of processing (Article 19 GDPR)

The controller communicates any rectifications or erasures or restrictions of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort, in accordance with Article 16, Article 17(1), and Article 18. The controller informs the data subject about these recipients if the data subject requests it.

6. Right to data portability (Article 20 GDPR)

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used, and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

• a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b);
• b) the processing is carried out by automated means.

When exercising the right to data portability pursuant to paragraph 1, the data subject has the right to obtain direct transmission of personal data from one controller to another, where technically feasible. The right under paragraph 1 shall not adversely affect the rights and freedoms of others.

7. Right to object (Article 21 GDPR)

The data subject shall have the right to object, at any time, to processing of personal data concerning him or her which is based on Article 6(1)(e) or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. The rights referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information at the latest at the time of the first communication with the data subject. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

8. Automated individual decision-making, including profiling, concerning natural persons (Article 22 GDPR)

1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
2. Paragraph 1 shall not apply if the decision:

• a) is necessary for entering into or performance of a contract between the data subject and a data controller;
• b) is authorized by Union or Member State law to which the data controller is subject, which also lays down suitable measures to safeguard the data subject's rights, freedoms, and legitimate interests;
• c) is based on the explicit consent of the data subject.

3. In cases referred to in paragraph 2, letters a) and c), the data controller shall implement suitable measures to safeguard the data subject's rights, freedoms, and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view, and to contest the decision.
4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and suitable measures to safeguard the data subject's rights, freedoms, and legitimate interests are in place.